ensure ampersands in URIs are xml-escaped